Commit 809cde54 authored by Guenter Knauf's avatar Guenter Knauf
Browse files

Fix to skip untrusted certs.

parent 476f194d

lib/mk-ca-bundle.pl

+29 −21
Original line number Diff line number Diff line
@@ -40,7 +40,7 @@ my $url = 'http://mxr.mozilla.org/mozilla/source/security/nss/lib/ckfw/builtins/ 
# If the OpenSSL commandline is not in search path you can configure it here!

my $openssl = 'openssl';



my $version = '1.15';

my $version = '1.16';



getopts('bhilnqtuv');
@@ -77,16 +77,14 @@ my $resp; 


unless ($opt_n and -e $txt) {

  print "Downloading '$txt' ...\n" if (!$opt_q);



  my $ua  = new LWP::UserAgent(agent => "$0/$version");

  $ua->env_proxy();

  $resp = $ua->mirror($url, $txt);

}



  if ($resp && $resp->code eq '304') {

    print "Not modified\n" unless $opt_q;

    exit 0;

  }

}



my $currentdate = scalar gmtime($resp ? $resp->last_modified : (stat($txt))[9]);
@@ -124,6 +122,7 @@ close(CRT) or die "Couldn't close $crt: $!"; 
print "Processing  '$txt' ...\n" if (!$opt_q);

my $caname;

my $certnum = 0;

my $skipnum = 0;

open(TXT,"$txt") or die "Couldn't open $txt: $!";

while (<TXT>) {

  if (/\*\*\*\*\* BEGIN LICENSE BLOCK \*\*\*\*\*/) {
@@ -147,6 +146,7 @@ while (<TXT>) { 
  if (/^CKA_LABEL\s+[A-Z0-9]+\s+\"(.*)\"/) {

    $caname = $1;

  }

  my $untrusted = 0;

  if (/^CKA_VALUE MULTILINE_OCTAL/) {

    my $data;

    while (<TXT>) {
@@ -158,6 +158,13 @@ while (<TXT>) { 
        $data .= chr(oct);

      }

    }

    while (<TXT>) {

      last if (/^#$/);

      $untrusted = 1 if (/^CKA_TRUST_SERVER_AUTH\s+CK_TRUST\s+CKT_NSS_NOT_TRUSTED$/);

    }

    if ($untrusted) {

      $skipnum ++;

    } else {

      my $pem = "-----BEGIN CERTIFICATE-----\n"

              . MIME::Base64::encode($data)

              . "-----END CERTIFICATE-----\n";
@@ -177,9 +184,10 @@ while (<TXT>) { 
      $certnum ++;

    }

  }

}

close(TXT) or die "Couldn't close $txt: $!";

unlink $txt if ($opt_u);

print "Done ($certnum CA certs processed).\n" if (!$opt_q);

print "Done ($certnum CA certs processed, $skipnum skipped).\n" if (!$opt_q);



exit;